Digital forensics includes the steps of collection, imaging, analysis, and presentation of evidence. In a related-art digital forensics, information only in a target computer is collected. Modern commercialized products such as EnCase and FTK collect data from one target computer, and also investigate a plurality of target computers in network connection-based remote forensics, but are limited by being able to collect data stored in an individual computer. That is, in a related-art digital forensics, valuable files such as document files that individual computers have worked through network sharing cannot be collected.
As an example, U.S. Patent Publication No. 20040260733 A1 entitled “Remote Collection of Computer Forensic Evidence” discloses a method for collecting remote evidence in digital forensics, which collects and analyzes computer generated volatile information, such as various log files, processes, and networks, but is limited to collecting data only in an individual computer.